Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-108735 →

DEBIAN-CVE-2026-108735

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setti...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

Miniflux 2.3.0 through 2.3.3 contains a server-side request forgery vulnerability that allows authenticated users to reach internal addresses by setting a feed's proxy_url. Attackers can point proxy_url at loopback or internal hosts, bypassing FETCHER_ALLOW_PRIVATE_NETWORKS checks to probe internal ports and send proxy-style requests to internal services.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:13 miniflux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:14 miniflux

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Références

advisory security-tracker.debian.org